Numerous companies’ attempts to engage directors in risk management have failed either because those attempts themselves were not properly conceived or directors – and the companies – lacked specific tools to meaningfully involve directors. These authors advance three highly practical and effective tools that will enable boards to make that meaningful contribution to the risk management discussion.
The uncertainty around the reporting of significant risks, including just what represents a “significant” risk, challenges many organizations today. Management and boards are facing questions regarding how strategy affects risk, and vice versa, and are challenged by how to best approach risk and discuss risk management in a meaningful, productive way. How can board directors and senior management be certain that they are making and approving the best possible decisions in the immediate and long term, and that the relevant risks have been appropriately taken into account? Was the right information given, received, and understood? What risk information is essential for accurately and efficiently evaluating decisions? This article will suggest appropriate responses to these important questions.
Three criteria for integrating risk information into decision making
There are three fundamental areas that must be addressed when developing an approach to risk-adjusted decision-making at the senior management level, and for helping the board understand risk-adjusted decisions to support corporate strategy. The first consideration is the quantification of the organization’s acceptable level of risk, or “risk appetite”. A second consideration is the involvement of various internal stakeholders into risk-adjusted decision-making to develop and debate strategic options. The final issue involves the composition, education and evaluation of board members that can evaluate strategic decisions on a risk-adjusted basis. All three areas are required for the most effective integration of risk information into decision-making and strategy evaluation.
Risk Appetite: Deciding what is too much (or too little) risk
Boards of directors and senior management have formally been discussing risk and risk management for some time, particularly as regulators have intensified requirements for public companies to evaluate their internal control processes and effectiveness. Both private and public entities have now begun to adopt practices to understand risk comprehensively beyond compliance, and to leverage that knowledge into better decision-making. These efforts have been met with mixed results, leaving risk covered only topically rather than examined thoroughly, especially how it is or is not embedded in the organization. In part, the mediocre results are due to a lack of shared understanding about risk and its effects on the organization, along both qualitative and quantitative dimensions.
The view that risk is a source of both downside loss potential and upside opportunity is also lost without a consistent approach to risk-adjusted decision-making, even though companies acknowledge that accepting risk is integral to executing strategy and growing a business. Traditional, qualitative approaches to risk management can produce risk- evaluation results that minimize the potential for risk to create value if they are not partnered with quantitative evaluation. Inconsistent levels of understanding about the key risks to the organization among senior management and the board frequently force the organization’s strategy to be either risk averse or work too quickly to minimize risk. Those parts of the organization that depend on accepting certain levels of exposure or risk in order to generate their returns can suffer. Other opportunities can be missed or avoided because the case cannot be sufficiently and unambiguously made that the risk justifies the return. The view that risks are individual and separate problems to be “solved” by executives as they implement strategic choices also prevents a comprehensive evaluation of the range of risks pertaining to the decision. Simplifying the understanding and reporting of risk to “red, yellow and green zones” is no longer adequate or advantageous as a risk management approach.
The link between risk appetite and decision-making is becoming increasingly important to attain sufficient, sustainable, and predictable growth at the corporate as well as business unit levels. Risk appetite establishes the baseline of what is “too much” or “too little” risk for the organization to assume and the acceptable and non-acceptable sources of that volatility. It can generally be defined as the level of variability in results that an organization is prepared to accept in support of stated objectives. A risk appetite statement will typically include elements such as target debt rating, target and minimum leverage ratios, exposure concentration limits and cash flow at risk limits in tandem with more qualitative factors (i.e., operational risk tolerance and minimum regulatory compliance standards). The combination of more than just the organization’s target debt rating or covenants allows for the integration of risk factors, tolerances and appetites from across multiple business lines. The risk appetite can then be leveraged into the creation of key metrics to measure performance for managing risk proactively. An example of how risk appetite and risk-adjusted decision-making are linked is shown in the Case Study below, which is a composite of several recent Mercer Oliver Wyman client engagements.
Case Study –Risk Appetite and Value at Risk
The Chief Risk Officer of a rapidly growing integrated company in the energy sector sought to improve his organization’s risk-adjusted decision-making capability. The need for an improved “risk-return” understanding was especially important as the company was undergoing a strategic planning review which would determine how capital was to be allocated across six divisions in the coming years and which potential acquisitions should be pursued. Mercer Oliver Wyman (MOW) helped the client tackle three key steps required to achieve genuine risk-adjusted decision-making:
1. Risk quantification:
Previous to this engagement, the client had a largely siloed approach to risk management which included quantification of commodity price and FX risks. Similar to most companies, the client was lacking an integrated approach to risk management and quantification of strategic/business risks. Using a combination of expert opinion, historical data and statistical techniques MOW helped the client build the capability to quantify over 50 financial, operational and strategic/business risk drivers and delivered a series of risk-adjusted metrics to outline the potential earnings volatility of each division linked to the P&L forecast. Sensitivity analysis was applied to the variables to demonstrate how shocks would influence financial performance.
2. Risk-return analysis:
After establishing risk metrics, two key enhancements to decision-making were made. Firstly, the four most important decision-making processes were selected (Annual business planning, M&A, Project approval, and Strategic Planning) and adjusted to ensure that quantitative risk output was included. Secondly, a new “risk-return portfolio model” was built by MOW to enable the client to input the Business Units’ return and risk information for each asset and determine a series of asset portfolio solutions. These solutions permit the client to determine the efficient frontier along which the optimal portfolio solutions lie.
3. Risk appetite:
The final step in developing risk-adjusted decision-making is to ensure that the corporate risk appetite is fully understood and drilled down into the company through the decision-making processes identified above. To achieve this, the client gathered information to gain consensus from key internal and external stakeholders on the desired risk profile across a variety of metrics (i.e. Earnings volatility, asset concentration). The widely divergent views held by stakeholders were well understood and the risk appetite was communicated and acted upon through the corporate strategy using appropriate tolerance levels for business segments.
In the end, the client gained the ability to define a more appropriate strategic direction and confidently articulate this direction to investors. The methodologies developed are now also enabling further enhancements including a more rigorous risk-adjusted cost of capital differentiation and more efficient use of risk management techniques in areas such as political and operational risk.
Understanding the company’s risk appetite and developing metrics to embed risk in key decision-making processes represents business performance with risk-adjusted information derived from the organization, as opposed to purely using senior management and the boards’ judgment of performance. Senior management and board members can ensure that objectives, critical risks and potential consequences are commonly understood from a fact-based context, and managed on a continuous basis – a balance to the experiential framework that is traditionally the foundation of making strategic decisions and evaluating risk. The integration of risk appetite into key decisions also represents a valuable method of optimizing the organization’s risk-return profile by facilitating the pooling of risks and outcomes using a common currency understood throughout the organization, even though business units or functions may operate independently. Further, a structured post decision-making evaluation that reflects on anticipated events versus outcomes improves managers’ understanding of risk by pinpointing gaps in identification, assessment or mitigation using both qualitative and quantitative means.
Stakeholder Engagement: Involving stakeholders in risk-adjusted decision-making
As noted above, a comprehensive determination of risk appetite requires the inclusion of pertinent qualitative and quantitative elements of risk. Therefore, a formal calculation and application of risk appetite require the participation of all functional areas across the organization. The “top-down” view needs to match the “bottom-up” reality, and measures need to be put in place to delineate the difference between “acceptable” and “unacceptable” risk for both the corporate level and business unit level.
Integration of multiple stakeholders is a significant challenge, but one that has started to receive attention in a number of organizations. In a recent survey conducted by The Conference Board (From Risk Management to Risk Strategy, 2005), more than half of senior managers surveyed reported that Enterprise Risk Management (ERM) has helped them make better-informed decisions. Yet only 15 per cent reported that ERM has been merged into the strategic planning or annual budget processes. This indicates that senior management is aware of the value of adjusting decision-making to incorporate perspectives from across the organization and is capable of involving internal stakeholders in discussing risk. Managers may not, however, be actively ensuring that collaboration or information-gathering is taking place on a regular basis or in a consistent manner.
Part of the challenge around developing the internal processes for involving a wide range of internal and external stakeholders is an issue of responsibility. Senior management in many organizations are recognizing that they are accountable for creating inclusive processes to make key decisions in a collaborative, transparent manner using opinion from across the organization. Decision-making in isolation is no longer considered a sign of good leadership. To document what styles were most associated with executive success, authors of a recently published study reviewed the forms of decision-making characteristic of executives at all levels. (The Seasoned Executive’s Decision-Making Style, Harvard Business Review, February, 2006). The authors found that successful senior managers used an integrative style, characterized as highly participative and process-driven, which allowed them to maximize the use of available information and evaluate multiple options. These skills are especially important in developing risk management strategy (and risk appetite) that reflects and responds to the whole organization and external requirements.
Another benefit of reflecting multiple perspectives in the corporate view of risk is the increased awareness of how the upside of risk plays into strategic options and the execution of strategic plans. The risks to the business play a role in both determining the organization’s strategy, and in the strategy execution – and a full understanding of risk is necessary for both the senior management and the board to optimize performance, to adjust their decision-making appropriately, and to minimize surprises. In addition to establishing internal processes for information flow, there should also be an attempt to evaluate and capture risk information from the external environment and stakeholders (e.g., customers, investors, strategic partners). Understanding which risks will be rewarded in the marketplace leverages the information into a more fulsome assessment of strategic opportunities. Also, recognition of how risks influence performance positively and negatively improves senior management’s understanding of the natural hedges to risks across the organization’s businesses. Determining strategy, as well as its successful execution, depends on understanding the reality within, across, and outside the organization.
The role of the board: Engagement, composition and assessment
If it is acceptable that senior management is ultimately tasked with the responsibility of determining what risk issues are significant to the organization, how can boards add significant value and develop a collaborative process?
Engaging the board in risk-adjusted decision making in the context of corporate strategy provides a focused and unique opportunity to gain value by encouraging active participation on strategic thinking, ensuring substantive involvement in decision-making and planning, and finally, for informed assessment of the process and progress of strategy execution. Generally, participation of the board in the various phases of corporate strategy is viewed by most as a critical role of the board. However, a study conducted jointly by the Center for Effective Organizations of the University of Southern California and Mercer Delta in 2004 found that only one in ten directors rate their own board as “very effective” in shaping long-term strategy or identifying threats and opportunities. Directors also gave their boards similar low ratings for reviewing progress on strategic goals. (USC/Mercer Delta Corporate Board Survey, March, 2005).
What can organizations do to increase the effectiveness of board engagement with corporate strategy? We believe there are three actions that CEOs and Boards can take. i) Construct a process that can produce value-added engagement, bringing the required level of structure, coupled with education, and then anchoring the process with phased timing and clear roles. For the critical consideration of risk in the formulation of strategy and monitoring of strategy execution, a collaborative strategy process with the board provides an ideal opportunity to educate board members on risk-adjusted decision-making. Education on key concepts of risk, such as risk appetite, enhances the board-level dialogue, strengthens their understanding of the trade-offs between risk and opportunity in strategy, and leads to a new level of understanding and engagement. Board members can increase their value-add and collective contribution based on a more intimate knowledge of current organizational performance, external industry and economic factors and the strategic choices that the organization is making, all within a comprehensive risk framework.
ii) Ensure that the board composition has the required diversity and specific knowledge to contribute to strategy development and monitoring its execution. A critical requirement for board members is, of course, independence. In addition, directors need to have sufficient levels of knowledge about the technologies, markets, competitors, or processes of the organization to adequately contribute to the definition of the risk appetite, assessment of strategic choices and ongoing monitoring a strategy execution against the backdrop of the risk framework. In a board with the right composition, directors bring complementary experiences and knowledge. The combined wisdom, judgment and perspectives are applied through effective board engagement techniques, leading to improved decision-making.
iii) Board-level engagement with strategy should be viewed as a process, not just an event or series of interactions. Increased engagement is usually developed as opportunities arise over time. The third action a board can take to improve the overall levels of performance and contribution is to put in place an assessment process that moves beyond meeting the formal compliance requirements to one that genuinely seeks to improve the way the board works, both as a team and with the CEO and senior management. The focus on providing constructive and relevant feedback helps the board and its members determine whether current board composition is aligned with corporate strategy, as well as identification of any “gaps” in skill set or perspective. Strategies for closing gaps can then be developed, so as to enhance the contribution the Board can make to key issues of corporate oversight, risk and strategy.
Developing advanced enterprise-wide risk management capabilities including risk-adjusted decision-making requires a comprehensive set of both quantitative and qualitative capabilities throughout the organization, among senior management and at the board level. Quantification of corporate and unit-level risk appetite and development of appropriate risk metrics are fundamental tools, in addition to timely and appropriate risk reporting. The development of the required management information should be undertaken in tandem with the expansion of integrative processes to be used by senior management as they solicit information from various internal stakeholders. Both management and boards should be prepared to identify and address skills lacking at the board level for supporting risk-adjusted decision-making, and to collaboratively develop expectations about how both groups can contribute value to the decision-making and strategy of the organization. Senior management should also consistently encourage the level of engagement of the board, provide education to the board on key risk issues and topics, as well as involve internal and external stakeholders in the decision-making process to support corporate strategy. Education, engagement and continuous improvement are the responsibility of leaders who wish to enhance strategy and economic value through risk-adjusted decision-making in partnership with their board.
